Frequently asked questions

Do I need to understand FAIR to use this? No. Start with the Just get a number path and estimate frequency and cost as ranges. The FAIR structure is there when you want to decompose a risk, but it's optional.

Where do I get the numbers to put in? From whatever you have: expert judgment, incident history, industry reports, vendor data. Estimates are ranges precisely so you can express uncertainty rather than pretend to precision. The Evidence stage lets you attach historical losses and see how well your model matches them.

Why does it show a range instead of one number? Because a single number hides the risk. A scenario with a $500K average but a $10M worst-case is very different from one capped at $600K — and only the range shows that. The loss exceedance curve is how you read the whole picture.

Why is the "mean" shown so small? Cyber losses are driven by rare, large events, so the simple average sits above the typical year and undersells the tail. The tool leads with tail figures (p95, p99, worst-5%-average) because those drive real decisions.

Is my data sent anywhere? The simulation runs in your browser. Your scenarios sync to your account so you can get to them from anywhere, but the modeling itself happens on your machine.

What are the four detail levels on the Results page? Admin, Management, Analyst, and Explore — the same run shown at different depths. Management is the default; Analyst adds statistical detail; Admin is a board-ready summary; Explore adds interactive tools. Switch freely; it never changes the underlying numbers.

Can I reuse an estimate across scenarios? Yes — save any distribution as a SIP into a library and bind other scenarios' factors to it. SIP libraries are managed under Data Libraries.

How many iterations should I run? The default (10,000+) is fine for most scenarios. If a tail figure like CVaR-99 still looks noisy, the tool will nudge you to increase iterations — the control is one click away in the re-run panel.